Analysis
- max time kernel
118s - max time network
130s - platform
windows7_x64 - resource
win7-20240221-es - resource tags
- submitted
03/04/2024, 02:50
General
- Target Debloat-Windows-10-master/scripts/fix-privacy-settings.ps1
- Size 7KB
- Sample240403-db43tseb49
- SHA256 a8e2f1195867da78f0e99d3faf067e773c297ef8e3053344cdf4fcce8b8ca202
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Debloat-Windows-10-master\scripts\fix-privacy-settings.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2504-4-0x000000001B150000-0x000000001B432000-memory.dmp
memory/2504-6-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp
memory/2504-5-0x0000000002530000-0x0000000002538000-memory.dmp
memory/2504-7-0x0000000002560000-0x000000000256E000-memory.dmp
memory/2504-8-0x00000000025A0000-0x0000000002620000-memory.dmp
memory/2504-9-0x000000001B680000-0x000000001B6C6000-memory.dmp
memory/2504-10-0x0000000002620000-0x000000000262A000-memory.dmp
memory/2504-11-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp
memory/2504-12-0x00000000025A0000-0x0000000002620000-memory.dmp
memory/2504-13-0x00000000025A0000-0x0000000002620000-memory.dmp
memory/2504-14-0x00000000026B0000-0x00000000026B8000-memory.dmp
memory/2504-16-0x000000001BAF0000-0x000000001BB3E000-memory.dmp
memory/2504-15-0x00000000025A0000-0x0000000002620000-memory.dmp
memory/2504-17-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp